Triage Snmp Diagnostics

Trace And Compare

• Work from the affected output back to its recorded inputs. Inspect the relevant profile, row, metric, or peer before expanding to all source operations. Follow source references using the normal-evidence owner; retain their context with any quoted result so another maintainer can reproduce the join.
• Separate latest attempts, retained failures/successes, and cached inputs using their own times. Resolve a stale value to its recorded source before attributing it to the latest refresh. Follow the inspection owner when a stage is unavailable; missing evidence is not proof that the device did not return data.
• Compare retained topology checkpoints with identical query controls. Match device identity and producer context before comparing registrations; obtain link selectors from each replay instead of carrying a row index across cuts. Use previous-run normal evidence only when it helps the incident, with the run boundaries made explicit.
• Distinguish profile/acquisition failures from processing and consumer decisions. A captured sample alone does not settle whether a chart was created or displayed; use the normal-evidence owner to bound that conclusion.
• For a source-level explanation, check the producer version against the code being read. Treat replay through a different checkout as a version-qualified experiment. Do not edit captured values to make a replay succeed.
• For discovery targets, collector enablement, polling settings, or profile overrides, inspect relevant files under 04-config/ and persisted UI/API configuration under 06-state/dyncfg/, when available. Compare them with the diagnostic evidence; persisted configuration may differ from what the collector used at capture time.

Correlate Companion Logs

• After establishing the evidence timeline, use the bundle inventory to find relevant logs and configuration. Prioritize available 05-logs/collector.log, 05-logs/journal-netdata.txt, and 05-logs/journal-namespace-netdata.txt; an empty collector log is not a reason to skip the journals.
• Use ordinary archive/text tools for logs. Start with SNMP matches, narrow using collector=snmp, collector=snmp_topology, and the affected job where present, then inspect nearby context. Include relevant go.d startup, shutdown, discovery, and job messages; do not restrict the search to warnings/errors or treat every SNMP match as a collector failure (alerts can also match).
• Correlate message times, jobs, and restarts with the incident and diagnostic capture/run boundaries. Consult the bundle's sanitization owner before joining identifiers: differently sanitized files may not share literal device names.
• Check log coverage and collection notes before interpreting missing matches; capped captures, missing history, and rate-limited messages cannot establish that no failure occurred. Keep conclusions within the captured window.

Report The Finding

Report the symptom and evidence coverage, then the supported failure location and its consequence. Cite the selected file or checkpoint, producer/run and capture time, and the relevant inspection branch or source reference. Separate observations from hypotheses and state what the capture cannot establish.

Recommend the smallest useful next check when evidence is insufficient, explaining which uncertainty it resolves. Use the operator capture owner when another bundle is needed; do not silently replace offline analysis with live SNMP polling, configuration changes, or sharing raw reports. When a fix is justified, hand the evidence and reproduction to the appropriate authoring skill rather than embedding an implementation workflow here.